Merge pull request #2115 from microsoftgraph/feat/automate-ossrh-release

Automate OSSRH releases to maven central
microsoftgraph · Aug 13, 2024 · ac24191 · ac24191
2 parents 929be22 + 24655dc
commit ac24191
Show file tree

Hide file tree

Showing 7 changed files with 289 additions and 224 deletions.
diff --git a/.github/workflows/gradle-build.yml b/.github/workflows/gradle-build.yml
@@ -18,8 +18,10 @@ jobs:
           java-version: 21
           distribution: 'temurin'
           cache: gradle
-      - name: Detect Secrets
-        uses: RobertFischer/[email protected]
+      - name: Detect secrets
+        run: |
+          pip install detect-secrets
+          git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
       - name: Grant Execute permission for gradlew
         run: chmod +x gradlew
       - name: Build with Gradle
@@ -46,7 +48,7 @@ jobs:
             settings.gradle
             gradle.properties
             **/gradle/**
-            Scripts/**
+            scripts/**
 
   build-java-8:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/preview-and-release.yml b/.github/workflows/preview-and-release.yml
@@ -14,8 +14,10 @@ on:
   workflow_dispatch:
 
 env:
-  PREVIEW_TASK: publishSnapshotPublicationToSonatypeSnapshotRepository
-  PUBLISH_TASK:  publishMavenCentralReleasePublicationToSonatypeRepository
+  PREVIEW_TASK: publishToSonatype
+  PUBLISH_TASK: publishToSonatype closeAndReleaseSonatypeStagingRepository
+  JAVA_VERSION: 21
+  JAVA_DISTRIBUTION: 'temurin'
 
 permissions:
   contents: write
@@ -26,24 +28,27 @@ jobs:
     environment:
       name: maven_central_snapshot
     runs-on: ubuntu-latest
+    needs: validate-package-contents
     steps:
       - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
-          java-version: 21
-          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          distribution: ${{ env.JAVA_DISTRIBUTION}}
           cache: gradle
-      - name: Easy detect-secrets
-        uses: RobertFischer/[email protected]
+      - name: Detect secrets
+        run: |
+          pip install detect-secrets
+          git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
       - name: Download File
-        run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+        run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
         shell: pwsh
         env:
           ENCODED_VALUE: ${{ secrets.LOCAL_PROPERTIES }}
           OUTPUT_PATH: '.\local.properties'
       - name: Download File
-        run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+        run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
         shell: pwsh
         env:
           ENCODED_VALUE: ${{ secrets.SECRING_GPG }}
@@ -58,32 +63,35 @@ jobs:
     environment:
       name: maven_central_release
     runs-on: ubuntu-latest
+    needs: validate-package-contents
     steps:
       - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
-          java-version: 21
-          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          distribution: ${{ env.JAVA_DISTRIBUTION}}
           cache: gradle
-      - name: Easy detect-secrets
-        uses: RobertFischer/[email protected]
+      - name: Detect secrets
+        run: |
+          pip install detect-secrets
+          git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
       - name: Download File
-        run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+        run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
         shell: pwsh
         env:
           ENCODED_VALUE: ${{ secrets.LOCAL_PROPERTIES }}
           OUTPUT_PATH: '.\local.properties'
       - name: Download File
-        run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+        run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
         shell: pwsh
         env:
           ENCODED_VALUE: ${{ secrets.SECRING_GPG }}
           OUTPUT_PATH: '.\secring.gpg'
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
       - name: Publish
-        run: ./gradlew $PUBLISH_TASK
+        run: ./gradlew $PUBLISH_TASK -PmavenCentralSnapshotArtifactSuffix=""
       - name: Upload Build Artifact
         uses: actions/upload-artifact@v4
         with:
@@ -98,11 +106,54 @@ jobs:
             settings.gradle
             gradle.properties
             **/gradle/**
-            Scripts/**
+            scripts/**
       - name: GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fail_on_unmatched_files: true
           files: |
             build/**/*.jar
+
+  validate-package-contents:
+    runs-on: ubuntu-latest
+    environment: ${{ contains(github.ref, 'refs/tags/v') && 'maven_central_release' || 'maven_central_snapshot' }}
+    defaults:
+      run:
+        working-directory: ./
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup JDK
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVA_VERSION }}
+        distribution: ${{ env.JAVA_DISTRIBUTION}}
+        cache: gradle
+    - name: Download file
+      run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+      shell: pwsh
+      env:
+        ENCODED_VALUE: ${{ secrets.LOCAL_PROPERTIES }}
+        OUTPUT_PATH: 'local.properties'
+    - name: Download file
+      run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+      shell: pwsh
+      env:
+        ENCODED_VALUE: ${{ secrets.SECRING_GPG }}
+        OUTPUT_PATH: '.\secring.gpg'
+    - name: Publish to local Maven cache for validation
+      run: ./gradlew --no-daemon publishToMavenLocal
+    - name: Get current SNAPSHOT version
+      shell: pwsh
+      run: |
+        $contents = Get-Content gradle.properties -Raw
+        $major = $contents | Select-String -Pattern 'mavenMajorVersion\s+= ([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+        $minor = $contents | Select-String -Pattern 'mavenMinorVersion\s+= ([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+        $patch = $contents | Select-String -Pattern 'mavenPatchVersion\s+= ([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+        $version = "$major.$minor.$patch-SNAPSHOT"
+        echo "Current version is $version"
+        echo "PACKAGE_VERSION=$version" >> $Env:GITHUB_ENV
+    - name: Inspect contents of local Maven cache
+      shell: pwsh
+      run: |
+        .\scripts\validatePackageContents.ps1 -ArtifactId msgraph-sdk-java -Version $env:PACKAGE_VERSION